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Abstract 



It is proved in this paper that for any point on an elliptic curve, 
the mean value of ^-coordinates of its n-division points is the same as 
its x-coordinate and that of y-coordinates of its n-division points is n 
>> ' times of its y-coordinate. 
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1 Introduction 

>< 

Let K be a field with char(if) ^ 2, 3 and let K be the algebraic closure of 
K. Every elliptic curve E over K can be written as a classical Weierstrass 
equation 

E : y 2 = x 3 + ax + b 

with coefficients a, b G K. A point Q on E is said to be smooth (or non- 
singular) if (M\q,^\q) ^ (0,0), where f(x, y) = y 2 -x 3 -ax-b. The point 
multiplication is the operation of computing 

nP = P + P + --- + P 

S v ' 

n 



for any point P G E and a positive integer n. The multiplication-by-n map 

[n] : E ->■ P 
P h-» nP 

is an isogeny of degree n 2 . For a point Q £ E, any element of [n] _1 (Q) 
is called an n-division point of Q. Assume that (char (If), n) = 1. In this 
paper, the following result on the mean value of the x, ^-coordinates of all 
the n-division points of any smooth point on an elliptic curve is proved. 

Theorem 1. Let E be an elliptic curve defined overK, and letQ = (xq, x/q) G 
E be a point with Q ^ O . Set 

A = {P = (x P , y P ) G E(K) | nP = Q}. 



Then 



and 



X P — Xq 

n* * — ' 
PeA 



n 2 *-^ 

PeA 



n 
PeA 



According to Theorem [T], let p = (xi,iji),i = 1, 2, ••• ,n 2 , be all the 
points such that nP = Q and let Aj be the slope of the line through Pj and 
Q, then y Q = Xi{x Q - x») + y t . Therefore, 



,2„ 



2 z/q = Y Xi ■ E x ^/ n2 ~ Y XiX{ + Y vi - 



n 

4=1 4 = 1 1 = 1 1=1 

Thus we have 



E^ Y. x i E-^i Y^Vi 



i=l i=l i=l i «'=1 \ — \ i — 

VQ = — 5 5 5 ! T~ = M- Xi- XiXi + y { 

n n n z n 



where Xi, Xi, XiXi, yi are the average values of the variables Xi,Xi,XiXi and 
yi, respectively Therefore, 

1 



Q = ( x Qi Vq) = (x» Xi- Xi- XiXi + Vi) = i x u -yi 

Remark: The discrete logarithm problem in elliptic curve E is to find n by 
given P, Q G E with Q = nP. The above theorem gives some information 
on the integer n. 



2 Proof of Theorem H 

To prove Theorem [TJ define division polynomials [9j ipn G 1i[x,y,a,b] on an 
elliptic curve E : y 2 = x 3 + ax + b, inductively as follows: 

^o = 0, 

4>i = l, 

^2 = 2y, 

■03 = 3x 4 + 6ax 2 + 125x — a 2 , 

ip 4 = 4y(x 6 + 5ax 4 + 20ax 3 — 5a 2 x 2 — Aabx — 8b 2 — a 3 ), 

02n+l = V'rHaV'n - VVi-lV&fl, for n > 2 > 
2^2n = V'n(V'n+2V'n-l ~ ^n-2^+i), for n > 3. 

It can be checked easily by induction that the ?/>2n's are polynomials. More- 
over, ip n G Z[x,?/ 2 ,a,o] when n is odd, and (2y)~ 1 ip n G Z[x, y 2 ,a, 6] when n 
is even. Define the polynomial 

for n > 1. Then n G Z[x, y 2 , a, 6]. Since y 2 = x 3 + ax + 6, replacing y 2 by 
x 3 + ax + 6, one have that <p n G Z[x, a, b]. So we can denote it by <p n (x). Note 
that, ip n ip m G Z[x, a, 6] if n and m have the same parity. Furthermore, the 
division polynomials ip n have the following properties. 

Lemma 2. 

n"-i n(n 2 - l)(n 2 + 6) n^s 

ip n = nx 2 H ax 2 + lower degree terms, 

60 

io/ien n zs odd, and 

/ r.2-4 (n 2 - l)(n 2 + 6) -30 n^8 

ip n = ny \ x * H ax 2 + lower degree terms 

V 60 

w/ien n zs even. 

Proof. We prove the result by induction on n. It is true for n < 5. Assume 
that it holds for all ip m with m < n. We give the proof only for the case for 



odd n > 5. The case for even n can be proved similarly. Now let n = 2k + 1 
be odd, where k > 2. If k is even, then by induction, 

^ fc+2 = (fc + 2)y(s%* + (^ + 4 fc+ 3)(^ + 4 fc+ 10)-30 ax ^±|^ + . . . ); 



V>*_i = {k - l)x 2 + i ^ g^ '-ax 2 + 

, /; , i\ fc2+2fc , (fc+l)(fc 2 +2fc)(fe 2 +2A:+7) fc 2 +2fc-4 . 

By substituting y 4 by (x 3 + ax + b) 2 , we have 

and 

4fc(fc - 1)(A; 3 + 2A; 2 + life + 7){k + l) 3 
60 
Therefore 



^-1^+1 = (fc-l)(fc+l)V fc2+2fc + ^^~ ±A " ^^ -r.A"T^ ag2fca+2fc _ 2+ . 



^2fc+l = ^fe+2-01 - ^k-lV'fc+l 

= (2jfc + l)x 2k2+2k + ( 2fc + x )( 4fc2 + 4fc )( 4fc2 + 4fc + 7 ) a:r 2fc2 + 2fc-2 _| 

= (2k + Ijx 12 ^ + (^i)(^ + i) 2 6o i)((^i) 2 + 6) ax (^±i)!^ + . . . 

The case when k is odd can be proved similarly. □ 

The following corollary follows immediately from Lemma EJ 
Corollary 3. 

,2 2 n 2 -l T2 2 (n 2 - l)(n 2 + 6) n 2_o 

V>„ = n 2 x™ x L ax n 3 H , 

^ n 30 



and 



„ 2 n 2 (n 2 - 1) n 2_ 2 
x n -ax n z + 



a 



Proof of Theorem [Q Define u n as 

Then for any P = (xp, yp) G E, we have ([5]) 

n (x P ) u n (x P ,y P ) 



nP 



^n(xp)' 1pn(xp,y P ) 



If nP = Q, then 4> n {xp) — xqi/j^xp) = 0. Therefore, for any P G A, the x- 
coordinate of P satisfies the equation (f> n (x) — XQip 2 (x) = 0. From Corollary 
[31 we have that 

4> n (x) — XQip^(x) = x n — n 2 XQX n _1 + lower degree terms. 

Since JJA = n 2 , every root of </> n (x) — XQipn(x) is the x-coordinate of some 
P G A. Therefore 

^2 x P = n 2 x Q 

pga 

by Vitae's Theorem. 

Now we prove the mean value formula for ^/-coordinates. Let K be the 
complex number field C first and let u± and u 2 be complex numbers which 
are linearly independent over R. Define the lattice 

L = Zwi + Z(X> 2 = {niCUi + n 2 Co>2 I n i, ^2 G Z}, 
and the Weierstrass p-function by 

p(z) = p(z,L) = -+ V (- -). 

For integers fc > 3, define the Eisenstein series G k by 



G k = G k (L)= J2 



uj-K 



Set g 2 = 6OG4 and g 3 = 140G 6 , then 

p'(z) 2 = Ap(zf - g 2 p(z) - g 3 . 



Let E be the elliptic curve given by y 2 = 4x 3 — g%x — g%. Then the map 

C/L ->■ E(C) 

z i-*- (p(z),p'(z)) , 
i— y oo, 

is an isomorphism of groups C/L and E(C). Conversely, it is well known [5] 
that for any elliptic curve E over C defined by y 2 = x 3 + ax + 6, there is a 
lattice L such that g2{L) = —4a, #3 (L) = —46 and there is an isomorphism 
between groups C/L and E(C) given by z >->■ (p(z), |p'(z)) and 1— » 00. 
Therefore, for any point (x, y) G E(C), we have (x,y) = (p(-z), |p (2)) and 
n(x,y) = (p(nz), \p (nz)) for some z G C. 

Let Q = (p(<2q), |p ( z q)) f° r a 2q G C Then for any Pi G A, 1 < i < n 2 , 
there exist integers j, k with < j, k < n — 1, such that 

p f,( z Q<i , k \ 1 ' f z Q , i , fc 
V V n n n / 2 \ n n n 



Thus 



E( zq j k \ 2 

\ n n n / 

„■ u—n \ / 



j,k=0 

n 2 

which comes from Y^Xi = n 2 XQ. Differential for zq, we have 



n-l 

£ 



p h -wi + -w 2 = n p (zq). 

\ n n n J 



That is 



J^2/i = n 3 y Q . 



Secondly, let i^ be a field of characteristic and let E be the elliptic curve 
over K given by the equation y 2 = x 3 + ax + 6. Then all of the equations 
describing the group law are defined over Q(a,6). Since C is algebraically 
closed and has infinite transcendence degree over Q, Q(a, b) can be considered 
as a subfield of C Therefore we can regard E as an elliptic curve defined 
over C. Thus the result follows. 



At last assume that K is a field of characteristic p. Then the elliptic curve 
can be viewed as one defined over some finite field W q , where q = p m for some 
integer m. Without loss of generality, let K = W q for convenience. Let 
K' = Q q be an unramified extension of the p-adic numbers Q p of degree m, 
and let E be an elliptic curve over K' which is a lift of E. Since (n,p) = 1, 
the natural reduction map E[n] —¥ E[n] is an isomorphism. Now for any 
point Q G E with Q ^ O, we have a point Q G E such that the reduction 
point is Q. For any point Pi G E(K) with nPi = Q, its lifted point Pi 
satisfies nPi = Q and Pi ^ Pj whenever Pi ^ Pj. Thus 



J2y^) = n 3 y(Q) 



since K' is a field of characteristic 0. Therefore the formula YlVi — n ^llQ 

t=i 

holds by the reduction from E to E. □ 

Remark: 

(1) The result for x-coordinate of Theorem [T] holds also for the elliptic 
curve defined by the general Weierstrass equation y 2 + a\xy + a 3 y = 
x 3 + CL2X 2 + (I4X + a,Q. 

(2) The mean value formula for x-coordinates was given in the first version 
of this paper [3] with a slightly complicated proof. The formula for y- 
coordinates was conjectured by D. Moody based on [3] and numerical 
examples in a personal email communication [6]. 

(3) Recently, some mean value formulae for twisted Edwards curves [TJ [2] 
and other alternate models of elliptic curves were given by [7] and [8]. 



3 An application 

Let E be an elliptic curve over K given by the Weierstrass equation y 2 = 

x 3 + ax + b. Then we have a non-zero invariant differential cu = —. Let 

y 

<p G End(-B) be a nonzero endomorphism. Then <p*u) = u o <p = c^uj for some 
c<£ G K(E) since the space Qe of differential forms on E is a 1-dimensional 



K(E) -vector space. Since c^ 7^ and div(w) = 0, we have 

div(c0) = div((p*oj) — div(u;) = 0*div(u;) — div(w) = 0. 

Hence c^ has neither zeros nor poles and c^ G K. Let if and ip be two nonzero 
endomorphisms, then 

c^+^uj = (<f + ip)*u = ip*uj + ip*u = c v uo + c^ijj = (c v + c,p)uj. 

Therefore, c v+ $ = 0^ + 0^. For any nonzero endomorphism 0, set <fi(x,y) = 
(R ( f ) (x),yS ( p(x)), where R^ and S^ are rational functions. Then 

R' 6 (x) 



S<f,(x) ' 

where RAx) is the differential of R ( p(x). Especially, for any positive integer 
n, the map [n] on E is an endomorphism. Set [n](x,y) = (R n (x),yS n (x)). 
From cm = 1 and [n] = [1] + [(n — 1)], we have 

C| " l = ^w =n - 

For any Q = (xq, y Q ) G E, and any 

P = (xp, y P )eA = {P = (x P , y P ) G E(K) I nP = Q}, 
we have yp = s y P r . Therefore, Theorem [1] gives 

S ^TTT = S ? = V ^ yp = n3 - 

p eA b n{x P ) p£A y Q y QpeA 



Thus 



and 



y \ = y \ = -Y 1 = n 2 

P^A R 'n( X P) f^ K n -S n (Xp) nf^ A S n (Xp) 
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